Re: [clamav-users] missed virus

2012-11-16 Thread TR Shaw
Hi winnow.attachments.hdb winnow_bad_cw.hdb winnow_malware_links.ndb Also work to stop these On Nov 15, 2012, at 4:55 PM, Steve Basford wrote: > >> OK, I'm stumped as to why clamav-milter did not catch this virus. It was >> from this address, being masked as from UPS: >> >> >> File: Invoices

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Alain Zidouemba
Can you confirm that you have the following (or similar) when running freshclam? Downloading bytecode-202.cdiff [100%] bytecode.cld updated (*version: 202*, sigs: 40, f-level: 63, builder: neo) - Alain ___ Help us build a comprehensive ClamAV guide: vi

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread McGranahan, Jamen
Unfortunately it has not been corrected. I run freshclam before every clamscan Jamen Sent from my iPhone On Nov 16, 2012, at 4:20 PM, "Alain Zidouemba" wrote: > The issue should have been fixed with bytecode.cvd version 202. > > Please let us know if you still have some issues. > > Thanks,

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Alain Zidouemba
The issue should have been fixed with bytecode.cvd version 202. Please let us know if you still have some issues. Thanks, - Alain ___ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml

Re: [clamav-users] Differences between Redhat and Debian clamav set up

2012-11-16 Thread francis picabia
On Fri, Nov 16, 2012 at 2:56 PM, francis picabia wrote: > I have a primary MX running Redhat, with postfix+amavisd+clamav > > I also have a secondary MX and SMTP gateway running Debian, with > postfix+amavisd-new+clamav > > Recently we adopted use of Sanesecurity additions, using the scamp script

[clamav-users] Differences between Redhat and Debian clamav set up

2012-11-16 Thread francis picabia
I have a primary MX running Redhat, with postfix+amavisd+clamav I also have a secondary MX and SMTP gateway running Debian, with postfix+amavisd-new+clamav Recently we adopted use of Sanesecurity additions, using the scamp script on both MX and SMTP. Root receives virus notifications on the SMTP

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Maarten Broekman
Success > -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clamav.net] On Behalf Of Matt Olney > Sent: Friday, November 16, 2012 11:44 AM > To: ClamAV users ML > Subject: Re: [clamav-users] LibClamAV Warnings > > Try now? > > On Fri,

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Matt Olney
Try now? On Fri, Nov 16, 2012 at 11:41 AM, Maarten Broekman wrote: > I have a bugzilla account but I don't have the right permissions to see > that bug. > You are not authorized to access bug #6139. > > --Maarten > >> -Original Message- >> From: clamav-users-boun...@lists.clamav.n

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Maarten Broekman
I have a bugzilla account but I don't have the right permissions to see that bug. You are not authorized to access bug #6139. --Maarten > -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clamav.net] On Behalf Of Matt Olney > Se

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Matt Olney
Can you attach that sample to this bug: https://bugzilla.clamav.net/show_bug.cgi?id=6139 Or if you don't have and don't want a bugzilla account, you can zip it up, password protect it and then send it to me. Matt On Fri, Nov 16, 2012 at 11:30 AM, Maarten Broekman wrote: > Yep. I have a .js fil

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Maarten Broekman
Yep. I have a .js file that triggers the Bytecode 37 error. I've filed a bug against the CVD with it. Bug 6140 - Bytecode 37 failed to run: Unknown error code --Maarten > -Original Message- > From: clamav-users-boun...@lists.clamav.net [mailto:clamav-users- > boun...@lists.clama

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Matt Olney
We're looking into it, guys. Don't have an answer right now, but thanks for the info. By chance, do you have a sample that triggers this behavior? Matt On Fri, Nov 16, 2012 at 11:04 AM, Maarten Broekman wrote: >> -Original Message- >> LibClamAV Warning: Bytecode run timed out in interp

Re: [clamav-users] LibClamAV Warnings

2012-11-16 Thread Maarten Broekman
> -Original Message- > LibClamAV Warning: Bytecode run timed out in interpreter after 765000 > opcodes LibClamAV Warning: Bytcode 16 failed to run: Unknown error code > LibClamAV Warning: Bytecode runtime error at line 95, col 13 LibClamAV > Error: Opcode 45 of type 0 is not implemented yet

[clamav-users] LibClamAV Warnings

2012-11-16 Thread McGranahan, Jamen
All of our RedHat boxes that are running clam are reporting these errors (started yesterday). We run clam every day on each of these servers, in the middle of the night, and we haven't had an issue until now. It concerns me that all of them are doing this (each one reporting a different bytecode

[clamav-users] Q re viri disposal

2012-11-16 Thread Gene Heskett
Greetings; In my .procmailrc, I have the following defined: VIRIBOX = "/var/spool/mail/virii" Then later: # Scan for viruses :0cW |clamdscan --no-summary --stdout - CLAMAV_CODE=$? :0 * $CLAMAV_CODE ?? 1 $VIRIBOX The log occasionally shows an "instream name of virus FOUND" But /var/log/mail/vi

Re: [clamav-users] confirm fc348079837XXXXXXXXXXXXXXXXXXXXXXXXb8a2a7

2012-11-16 Thread Steve Scotter
Hi, I've had four of these in the last couple of months but hadn't had much time to look into it until today. Having checked my mail logs for 'clamav.net' I found an entry. 2012-11-15 21:57:26 mail info postfix/cleanup[63281] 4BBB21ABD25: milter-reject: END-OF-MESSAGE from ds049.xs4all.nl